Every CVE Search/ Get API key

CVE-2026-13769

Overly permissive File Permissions in AWS CLI

6.8 MediumFix available

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.17%Up 0.1 points since Jul 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

Overly permissive File Permissions in AWS CLI

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Record
CVE-2026-13769
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
EUVDEUVD-2026-41116 6.8

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Record
EUVD-2026-41116
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wfp6-f47h-hxc3 6.8

AWS CLI: Overly permissive File Permissions

Summary

The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials. 

Impact

On Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600): 

  • aws codeartifact login 

  • aws iam create-virtual-mfa-device  

  • aws deploy register 

Any other local user on the same host could read these files and obtain the credentials.  

Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2)

Patches

This issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Record
GHSA-wfp6-f47h-hxc3
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
NVD 6.8

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Record
CVE-2026-13769
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
OSV 6.8

Overly permissive File Permissions in AWS CLI

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Record
CVE-2026-13769
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-732
Updated
2026-11-02
OSVGHSA-wfp6-f47h-hxc3 6.8

AWS CLI: Overly permissive File Permissions

Summary

The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials. 

Impact

On Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600): 

  • aws codeartifact login 

  • aws iam create-virtual-mfa-device  

  • aws deploy register 

Any other local user on the same host could read these files and obtain the credentials.  

Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2)

Patches

This issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Record
GHSA-wfp6-f47h-hxc3
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
OSVPYSEC-2026-3548 6.8

AWS CLI: Overly permissive File Permissions

Summary

The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials. 

Impact

On Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600): 

  • aws codeartifact login 

  • aws iam create-virtual-mfa-device  

  • aws deploy register 

Any other local user on the same host could read these files and obtain the credentials.  

Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2)

Patches

This issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Record
PYSEC-2026-3548
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
awscli
PyPI
 through 1.44.77
1.44.78
awscli
PyPI
 before 1.44.78, plus listed versions
0.10.10.11.00.12.00.13.00.13.1
Show 45 moreShow less
0.13.20.14.00.14.10.15.00.16.00.4.10.4.20.4.30.4.40.4.50.5.00.5.10.5.20.5.30.6.00.7.00.8.00.8.10.8.20.8.30.9.10.9.20.9.31.0.01.1.01.1.11.1.21.10.01.10.11.10.101.10.111.10.121.10.131.10.141.10.151.10.161.10.171.10.181.10.191.10.21.10.201.10.211.10.221.10.231.10.24
1.44.78

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13769 is a medium vulnerability (CVSS 6.8) in Aws Cli, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in awscli 1.44.78.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 2,370 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open